Subprocessors

Last Updated: August 28, 2026

This page lists the third-party service providers ("subprocessors") that process personal data on Gryter's behalf, what each one receives, and where. It is referenced by our Privacy Policy and is kept current as part of it.

Every provider listed here acts as our processor: each processes your data on our behalf, on our instructions and for our purposes only, under the processing terms that apply to the paid services we use.

Status, stated plainly: we are in the process of putting formal data processing agreements and international transfer terms in place with each provider named below. Completing them is a prerequisite to offering Gryter in the EEA or the UK, and we will update this page when each is done. Where a provider's own published terms already commit them — for example, the paid API tiers we use exclude training on customer data by default — we say so on the entry.

AI providers

Gryter uses AI models to generate coaching. The approved set of AI providers is OpenAI, Anthropic, and Google. No other AI provider is permitted to receive Gryter data.

Sending your information to an AI provider requires your explicit consent, which you can withdraw at any time in the app. What we send, and what we never send, is described in Section 9 of the Privacy Policy.

Currently in use

• OpenAI — OpenAI, L.P. and affiliates, United States.
  • Used for: all AI coaching features — setting up your coaching, reviewing changes to your setup, putting coaching and nutrition guidance into words, and estimating meals from a description or photo.
  • Receives: your training and health context, the free text you write, and meal descriptions and photos where you use that feature. Never your name, email address, profile photo, account identifier, or payment information.
  • Training on your data: not permitted. Excluded by default on the paid API tier under OpenAI's own published API data-usage terms.
  • Retention: requests and responses are retained for at least 30 days, then deleted under OpenAI's data retention terms.
  • Processing location: United States.
  • Transfer terms: OpenAI publishes EU Standard Contractual Clauses and a UK International Data Transfer Addendum. Being executed — see Status above.

Approved, not currently in use

The following are approved to receive Gryter data and may be used in future. No Gryter user data is being sent to either of them today. If that changes, we will update this page at least 30 days beforehand — see "How we change this list" below.

• Anthropic — Anthropic PBC, United States. Approved for the same AI coaching purposes as above.
• Google (Gemini models) — Google LLC / Google Ireland Limited. Approved for the same AI coaching purposes as above.

Infrastructure and other providers

• Google — Firebase (Google LLC / Google Ireland Limited, United States).
  • Used for: account authentication, database, server functions, push notifications, app integrity checks, and — only if you opt in — usage analytics and crash diagnostics.
  • Receives: substantially all of your account data. This is our core infrastructure.
  • Processing location: United States.
  • Transfer terms: EU Standard Contractual Clauses and UK Addendum, under Google's Cloud Data Processing Addendum. Being confirmed for our project — see Status above.
• RevenueCat (RevenueCat, Inc., United States).
  • Used for: managing subscriptions and verifying entitlements.
  • Receives: your Gryter account identifier, subscription status, product identifiers, and purchase and renewal timestamps. No card details.
  • Processing location: United States.
• Resend (Plus Five Five, Inc., United States).
  • Used for: sending transactional email — your data export, and our internal notices.
  • Receives: your email address and the contents of the message, which for an export includes your exported data as an attachment.
  • Processing location: United States.
• Cloudflare (Cloudflare, Inc., United States).
  • Used for: hosting and delivering gryter.com.
  • Receives: standard web request data, including IP addresses, transiently.
  • Processing location: globally distributed edge network.
• Google — Apps Script, Sheets, and Gmail (Google LLC).
  • Used for: receiving and storing website waitlist and early-access sign-ups.
  • Receives: your email address, what you wrote in the goal field, which offer or early-access option you asked about, and basic referral information.
  • Processing location: United States.

Not subprocessors

Apple and Google, in their roles as app stores and sign-in providers, are not our processors. They act as independent controllers for sign-in, app distribution, and payment processing, under their own privacy policies. We receive subscription status from them; they do not receive your training or health data from us.

How we change this list

• Before we add a new subprocessor, or begin using an approved AI provider that is not currently in use, we update this page at least 30 days in advance.
• Where a change affects how your health data is handled — for example, a new AI provider, or a materially different retention period — we will also notify you in the app and, where the law requires it, ask for your consent again before the change applies to you.
• Changes to a provider's own subprocessors are governed by that provider's agreement with us.

To be notified of changes, or to ask about the status of the agreements described above, email [email protected].